You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/app-service/configure-authentication-provider-google.md
+23-17Lines changed: 23 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Configure Google Authentication
3
3
description: Learn how to configure Google authentication as an identity provider for your App Service or Azure Functions app.
4
4
ms.assetid: 2b2f9abf-9120-4aac-ac5b-4a268d9b6e2b
5
5
ms.topic: how-to
6
-
ms.date: 03/29/2021
6
+
ms.date: 07/10/2025
7
7
ms.custom: fasttrack-edit, AppServiceIdentity
8
8
author: cephalin
9
9
ms.author: cephalin
@@ -20,32 +20,38 @@ To complete the procedure, you must have a Google account that has a verified em
20
20
21
21
## <aname="register"> </a>Register your application with Google
22
22
23
-
1. Follow the Google documentation at [Sign In with Google for Web - Setup](https://developers.google.com/identity/gsi/web/guides/fedcm-migration) to create a client ID and client secret. You don't need to make any code changes. Use the following information:
24
-
- For **Authorized JavaScript Origins**, use `https://<app-name>.azurewebsites.net`with the name of your app in *\<app-name>*.
25
-
- For **Authorized Redirect URI**, use `https://<app-name>.azurewebsites.net/.auth/login/google/callback`.
26
-
1.Copy the **App ID** and the **App Secret** values.
23
+
1. Follow the Google documentation at [Get your Google API client ID](https://developers.google.com/identity/gsi/web/guides/get-google-api-clientid) to create a client ID and client secret. You don't need to make any code changes.
24
+
- For **Authorized JavaScript Origins**, use `https://<app-name>.azurewebsites.net`, replacing `<app-name>`with the name of your app.
25
+
- For **Authorized Redirect URI**, use `https://<app-name>.azurewebsites.net/.auth/login/google/callback`.
26
+
1.Make a note of the **App ID** and the **App Secret** values to use in the Azure app configuration.
27
27
28
-
> [!IMPORTANT]
29
-
> The **App Secret** value is an important security credential. Don't share this secret with anyone or distribute it within a client application.
28
+
> [!IMPORTANT]
29
+
> The **App Secret** value is an important security credential. Don't share this secret with anyone or distribute it within a client application.
30
30
31
31
## <aname="secrets"> </a>Add Google information to your application
32
32
33
-
1. Sign in to the [Azure portal] and go to your app.
34
-
1. Select **Authentication** on the left menu. Select **Add identity provider**.
35
-
1. Select **Google** in the identity provider dropdown. Paste in the **App ID** and **App Secret** values that you obtained previously.
33
+
1. On the [Azure portal] page for your app, select **Authentication** under **Settings** in the left navigation menu.
36
34
37
-
The secret is stored as a slot-sticky [application setting](./configure-common.md#configure-app-settings) named `GOOGLE_PROVIDER_AUTHENTICATION_SECRET`. You can later update that setting to use [Key Vault references](./app-service-key-vault-references.md) if you wish to manage the secret in Azure Key Vault.
35
+
1. On the **Authentication** page, select **Add identity provider**, or select **Add provider** in the **Identity provider** section.
38
36
39
-
1. If this is the first identity provider configured for the application, you're also prompted with an **App Service authentication settings** section. Otherwise, you can move to the next step.
40
-
41
-
The **App Service authentication settings** values determine how your application responds to unauthenticated requests. The default selections will redirect all requests to sign in with this new provider. You can customize this behavior now or adjust these settings later from the main **Authentication** screen by choosing **Edit** next to **Authentication settings**. To learn more about these options, see [Authentication flow](overview-authentication-authorization.md#authentication-flow).
37
+
1. On the **Add an identity provider** page, select **Google** in the identity provider dropdown.
38
+
39
+
1. Enter the **App ID** and **App Secret** values you obtained previously.
40
+
41
+
1. If this is the first identity provider for the application, the **App Service authentication settings** section appears with settings such as how your application responds to unauthenticated requests. The default selections redirect all requests to sign in with the new provider.
42
+
43
+
If you already configured an identity provider for the app, this section doesn't appear. You can customize the settings later if necessary.
42
44
43
45
1. Select **Add**.
44
46
45
-
> [!NOTE]
46
-
> For adding scope: You can define what permissions your application has in the provider's registration portal. The app can request scopes at the time of sign-in, which use these permissions.
47
+
On the **Authentication** page, the **Google** provider now appears in the **Identity provider** section. You can edit the provider settings by selecting the pencil icon under **Edit**.
47
48
48
-
You're now ready to use Google for authentication in your app. The provider is listed on the **Authentication** screen. From there, you can edit or delete this provider configuration.
49
+
The **Authentication settings** section shows settings such as how the application responds to unauthenticated requests. You can edit these settings by selecting **Edit** next to **Authentication settings**. To learn more about the options, see [Authentication flow](overview-authentication-authorization.md#authentication-flow).
50
+
51
+
The application secret is stored as a slot-sticky [application setting](configure-common.md#configure-app-settings) named `GOOGLE_PROVIDER_AUTHENTICATION_SECRET`. You can see this setting on the **App Settings** tab of your app's **Environment variables** page in the portal. If you want to manage the secret in Azure Key Vault, you can update the setting to use [Key Vault references](app-service-key-vault-references.md).
52
+
53
+
> [!NOTE]
54
+
> To add scopes, define the permissions your application has in the provider's registration portal. The app can request scopes that use these permissions at sign-in time.
This article shows you how to configure Azure App Service or Azure Functions to use a custom authentication provider that adheres to the [OpenID Connect (OIDC) specification](https://openid.net/connect/). OIDC is an industry standard that many identity providers (IDPs) use. You don't need to understand the details of the specification for your app to use an OIDC identity provider.
18
+
This article shows you how to configure Azure App Service or Azure Functions to use a custom authentication provider that adheres to the [OpenID Connect (OIDC) specification](https://openid.net/connect/). OIDC is an industry standard that many identity providers use. You don't need to understand the details of the specification to use an OIDC identity provider for your app.
19
19
20
-
You can configure your app to use one or more OIDC providers. Each provider must have a unique alphanumeric name in the configuration. Only one provider can serve as the default redirect target.
20
+
You can configure your app to use one or more OIDC providers. You must give each OIDC provider a unique friendly name in the app configuration. Only one provider can serve as the default redirect target.
21
21
22
-
## <aname="register"> </a>Register your application with the identity provider
22
+
## <aname="register"> </a>Register your app with the OIDC identity provider
23
23
24
-
Your provider requires you to register the details of your application with it. One of these steps involves specifying a redirect URI that has the form `<app-url>/.auth/login/<provider-name>/callback`. Each identity provider should provide more instructions on how to complete the steps. The `<provider-name>`value refers to the friendly name that you give to the OpenID provider name in Azure.
24
+
Your provider requires you to register your application by specifying a redirect URI in the form `<app-url>/.auth/login/<provider-name>/callback`. In the redirect URI, replace `<app-url>` with your app URL and `<provider-name>`with the friendly name you're giving the OpenID provider in Azure.
25
25
26
26
> [!NOTE]
27
-
> Some providers might require extra steps for their configuration and for using the values that they provide. For example, Apple provides a private key that isn't itself used as the OIDC client secret. You use it to create a JSON Web Token (JWT). You use the web token as the secret that you provide in your app configuration. For more information, see [Creating a client secret](https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens).
27
+
> The OpenID provider name can't contain a hyphen `-`, because an App Service application setting is created based on this name, and application settings don't support hyphens. You can use an underscore `_` instead.
28
28
29
-
You need to collect a *client ID* and a *client secret* for your application. The client secret is an important security credential. Don't share this secret with anyone or distribute it in a client application.
29
+
When you register your app, you need to collect a *client ID* and a *client secret* for your application. Make a note of these values to use in the Azure app configuration.
30
30
31
31
> [!NOTE]
32
-
> You only need to provide a client secret to the configuration if you would like to acquire access tokens for the user through interactive login flow using the authorization code flow. If this is not your case, collecting a secret is not required.
32
+
> - The client secret value is an important security credential. Don't share this secret with anyone or distribute it within a client application.
33
+
> - Your app must provide the client secret if you want users to acquire access tokens using the interactive authorization code flow. If you don't want to acquire access tokens, you don't need to use a secret.
33
34
34
-
You also need the OIDC metadata for the provider. This metadata is often exposed in a [configuration metadata document](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig), which is the provider's issuer URL suffixed with `/.well-known/openid-configuration`. Get this configuration URL.
35
+
You also need the provider's OIDC metadata. This metadata is often exposed in a [configuration metadata document](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig) that you can get at the path formed by appending `/.well-known/openid-configuration` to the provider's issuer URL.
35
36
36
-
If you can't use a configuration metadata document, get the following values separately:
37
+
If you can't access a configuration metadata document, get the following values separately:
37
38
38
-
- The issuer URL (sometimes shown as `issuer`)
39
-
- The [OAuth 2.0 authorization endpoint](https://tools.ietf.org/html/rfc6749#section-3.1) (sometimes shown as `authorization_endpoint`)
40
-
- The [OAuth 2.0 token endpoint](https://tools.ietf.org/html/rfc6749#section-3.2) (sometimes shown as `token_endpoint`)
41
-
- The URL of the [OAuth 2.0 JSON Web Key set](https://tools.ietf.org/html/rfc8414#section-2) document (sometimes shown as `jwks_uri`)
39
+
- The issuer URL, sometimes shown as `issuer`.
40
+
- The [OAuth 2.0 authorization endpoint](https://tools.ietf.org/html/rfc6749#section-3.1), sometimes shown as `authorization_endpoint`.
41
+
- The [OAuth 2.0 token endpoint](https://tools.ietf.org/html/rfc6749#section-3.2), sometimes shown as `token_endpoint`.
42
+
- The URL of the [OAuth 2.0 JSON Web Key set](https://tools.ietf.org/html/rfc8414#section-2) document, sometimes shown as `jwks_uri`.
43
+
44
+
Each identity provider should provide instructions on how to complete the registration steps. Some providers might require extra steps for their configuration or for using the values that they provide. For example, Apple provides a private key that you use to create a JSON Web Token (JWT), which you enter as the secret in your app configuration. For more information, see [Creating a client secret](https://developer.apple.com/documentation/sign_in_with_apple/generate_and_validate_tokens).
42
45
43
46
## <aname="configure"> </a>Add provider information to your application
44
47
45
-
To add provider information for your OpenID Connect provider, follow these steps.
48
+
To configure the OpenID Connect provider in Azure, follow these steps:
49
+
50
+
1. On the [Azure portal](https://portal.azure.com) page for your app, select **Authentication** under **Settings** in the left navigation menu.
46
51
47
-
1.Sign in to the [Azure portal] and go to your app.
52
+
1.On the **Authentication** page, select **Add identity provider**, or select **Add provider** in the **Identity provider** section.
48
53
49
-
1. On the left menu, select **Settings** > **Authentication**. Then select **Add identity provider**.
54
+
1. On the **Add an identity provider** page, select **OpenID Connect** as the provider.
50
55
51
-
1. For **Identity provider**, select **OpenID Connect**.
56
+
1. For **OpenID provider name**, enter the friendly name you chose for your OIDC provider.
52
57
53
-
1.For**OpenID provider name**, provide the unique alphanumeric name that you selected earlier.
58
+
1.Under**OpenID Connect provider configuration**, if you have a metadata document from the identity provider, select **Document URL** for **Metadata entry**.
54
59
55
-
1.If you have the URL for the metadata document from the identity provider, provide that value for **Metadata URL**.
60
+
If you don't have a metadata document, select **Enter metadata**, and enter each URL from the identity provider in the appropriate field.
56
61
57
-
Otherwise, select **Provide endpoints separately**. Put each URL from the identity provider in the appropriate field.
62
+
1. Under **App registration**, provide the values you collected earlier for **Client ID** and **Client secret**.
58
63
59
-
1.Provide the values that you collected earlier for **Client ID**. If the **Client secret**was also collected, provide it as part of the configuration process.
64
+
1.If this is the first identity provider for the application, the **App Service authentication settings**section appears with settings such as how your application responds to unauthenticated requests. The default selections redirect all requests to sign in with the new provider.
60
65
61
-
1. Specify an application setting name for your client secret. Your client secret is stored as an app setting to ensure that secrets are stored in a secure fashion. If you want to manage the secret in Azure Key vault, update that setting later to use [Azure Key Vault references](./app-service-key-vault-references.md).
66
+
If you already configured an identity provider for the app, this section doesn't appear. You can customize the settings later if necessary.
62
67
63
68
1. Select **Add** to finish setting up the identity provider.
64
69
65
-
> [!NOTE]
66
-
> The OpenID provider name can't contain a hyphen (-) because an app setting is created based on this name. The app setting doesn't support hyphens. Use an underscore (_) instead.
67
-
>
68
-
> It also requires that the `aud` scope in your token be the same as the **Client Id** as configured above. It is currently not possible to configure the allowed audiences for this provider at the moment.
70
+
On the **Authentication** page, **\<oidc_friendly_name>(custom provider)** now appears in the **Identity provider** section. You can edit the provider's settings by selecting its pencil icon under **Edit**.
71
+
72
+
The **Authentication settings** section shows settings such as how the application responds to unauthenticated requests. You can edit these settings by selecting **Edit** next to **Authentication settings**. To learn more about the options, see [Authentication flow](overview-authentication-authorization.md#authentication-flow).
73
+
74
+
The application secret is stored as a slot-sticky [application setting](configure-common.md#configure-app-settings) named `<oidc_friendly_name>_AUTHENTICATION_SECRET`. You can see the setting on the **App Settings** tab of your app's **Environment variables** page in the portal. If you want to manage the secret in Azure Key Vault, you can edit the setting to use [Key Vault references](app-service-key-vault-references.md).
75
+
76
+
>[!NOTE]
77
+
>To add scopes, define the permissions your application has in the provider's registration portal. The app can request scopes that use these permissions at sign-in time.
69
78
>
70
-
> Azure requires `openid`, `profile`, and `email` scopes. Make sure that you configure your app registration in your ID provider with at least these scopes.
79
+
>- Azure requires `openid`, `profile`, and `email` scopes. Make sure that you configure your app registration in your identity provider with at least these scopes.
80
+
>- The `aud` scope must be the same as the configured **Client Id**. You can't configure the allowed audiences for this provider.
0 commit comments